How CampusHack is played

Short, and enforced. Anything not covered here, ask before the event rather than during it.

Eligibility

Teams are four currently registered university students.
Every member must be enrolled at the institution the team represents.
One team per institution competes at the finals, earned through that institution's qualifier.

During the competition

Flags are submitted only through the official platform.
Sharing flags, hints or solutions between teams means disqualification for everyone involved.
Attacking the scoring platform, the network, or other teams' machines is out of bounds. The targets are the challenges.
Denial of service against any challenge service is prohibited — if you break it, nobody else can play.
Automated scanners that generate heavy traffic are not allowed unless a challenge says otherwise.
Any resource on the open internet is fair game. Asking a person outside your team is not.

Scoring

Jeopardy challenges use dynamic scoring: a challenge is worth less as more teams solve it.
Boot-to-root machines award partial credit for the user flag and full credit for root.
The scoreboard freezes for the final thirty minutes. You can still submit; you just cannot see the standings.
Ties are broken by the timestamp of the last scoring submission.

Disputes

Raise anything unclear with the organisers during the event, not afterwards.
Challenge corrections are announced to every team at once through the platform.
Final standings are confirmed by the organising team and published on this site.

Conduct

CampusHack exists to get more people into security, including people who have never done this before. Gatekeeping, harassment or mocking beginners gets a team removed. Help someone from another university after the event, not during it.

FAQ

Frequently asked

Who can take part?

Any team of three to four students currently registered at a Cameroonian university. You do not need prior CTF experience — a good share of the challenges are written specifically for people doing this for the first time.

Does it cost anything?

No. Entry is free at both phases and it will stay that way. Sponsors cover the platform, venue, prizes and materials.

What if my university is not listed?

Get in touch. We are actively looking for institutions to host qualifiers, and adding one is mostly a matter of finding a room and a date.

What should we know before entering?

Comfort with Linux, a browser's developer tools, and a scripting language will carry you a long way. Everything else you can learn on the day — that is rather the point.

What is a boot-to-root machine?

A full virtual machine you have to break into and then escalate to administrator on. There are two at the finals, one Linux and one Windows, and they open alongside the jeopardy board.

Can we use the internet during the competition?

Yes. Any documentation, search engine or tool you can reach is fair game. What you cannot do is ask a person outside your team, or share flags with another team.

How are the winners decided?

Dynamic scoring: a challenge is worth fewer points as more teams solve it. The scoreboard freezes for the last thirty minutes, so the final standings are a surprise to everyone including us.

Where do results get published?

On this site, on the leaderboard, within a week of each event. Official writeups follow within two weeks.